Category: Applications

Help Support RadioCapture – A Project that Records Entire Trunked Radio Systems and Provides Online Access to Audio

RadioCapture.com is a website run by Matt Mills that is capable of automatically capturing trunked radio communications from various agencies such as the emergency services and creating publicly accessible historical and live logs of the audio. This is a concept different to radio scanner streams, as all audio is logged and historical audio can be accessed easily at any time.

The system is based on SDR hardware such as the RTL-SDR. Currently Matt runs a receiver in Denver and captures Denver PD which can be listened to on the site without needing to log in. Once logged in (registration is free), other talkgroups available include various agencies in Colorado, New Jersey and Pennsylvania.

RadioCapture.com currently available Talkgroups being logged
RadioCapture.com: Currently available talkgroups being logged

Recently Matt has put a call out for people to help support the site via Patreon. He notes that RadioCapture is currently run as a hobby, but with monetary support he hopes to be able to expand the site into a business and have receivers listening and uploading worldwide. He writes:

Hey! Thanks for supporting the continued operation and development of Radiocapture.com. This is a hobby project I've been working on this since late 2011. I'd like to turn it into a real business with your help.

Radiocapture.com is a software defined radio system I built that captures entire trunked radio systems. It demodulates and captures every call on every channel of one, or many systems.

A single RadioCapture server can capture hundreds of simultaneous voice transmissions and a bunch of sites, additionally it's designed in such a way that it can run across multiple computers. My biggest RF site uses 3 machines to capture 19 P25 systems, and easily hits more than 100 active voice channels recordings simultaneously every day.

Matt has also noted that if the site is able to become self-sustaining via Patreon, he hopes to also be able to bring out a RadioCapture kit consisting of 10-16 RTL-SDR dongles, hubs and cables which would allow anyone to easily capture and upload almost all trunked communications from their area. He also notes that at the time of writing:

RadioCapture has 701790271 unique recordings of 503779875 unique transmissions (some calls get captured on multiple transmitters) from the 21 systems that have been captured

If you're interested in talking to Matt about the site, you can also join his Rocket.Chat room at radiocapture.chat.

RadioCapture logged audio
RadioCapture playing logged audio

Reaching Across Europe with a Raspberry Pi Zero and WsprryPi

Over on YouTube user Techminds has uploaded a video that shows how he is using a Raspberry Pi Zero to transmit WSPR. To do this he uses the WsprryPi software which allows you to transmit WSPR by connecting an antenna directly to a GPIO pin on the Pi Zero. With this no extra hardware is required, although a filter is highly recommended to reduce spurious emissions from harmonics.

In his test Tech Minds directly connected the Pi Zero to an unun and HF wire antenna and ran WsprryPi. His results showed that even with the tiny 10mW output power of the Pi Zero's GPIO port his WSPR messages were able to reach several receivers halfway across Europe, and even to Iceland and Morocco from his home in the UK.

WSPR is an amateur radio digital HF mode designed to be decodable even if the signal is transmitted with very low power and is very weak. It can be used to help determine HF radio propagation conditions as WSPR reception reports are typically automatically uploaded to wsprnet.

WSPR - Weak Signal Propagation Reporter - From A Pi Zero ?

SignalsEverywhere: KerberosSDR Direction Finding Video Tutorial

Over on his YouTube channel SignalsEverywhere, Corrosive has uploaded a new video about setting up a KerberosSDR for direction finding. KerberosSDR is our new 4-input Coherent RTL-SDR that was crowdfunded on Indiegogo, and has now shipped to all backers. With KerberosSDR applications like direction finding and passive radar are possible. If you're interested, there are still about 70 units available in this batch. After that a second batch will be available in a few months.

In the video he goes over the full set up procedure, from setting up his chosen computing platform (a Raspberry Pi 3) to connecting up the KerberosSDR, connecting to it's web interface, calibrating, setting up the antennas, and then demonstrating some direction finding with four whip antennas on his car and a HackRF used as a signal source.

Radio Direction Finding Equipment KerberosSDR Coherent 4 x RTL SDR RDF Setup

SignalsEverywhere: ADS-B Aircraft Tracking with RTL-SDR, dump1090 and Virtual Radar Server

Over on his YouTube channel Corrosive from the SignalsEverywhere YouTube channel has uploaded a tutorial that shows how to set up ADS-B aircraft tracking with an RTL-SDR, dump1090 and Virtual Radar Server. The decoder software is dump1090 which is a multiplatform command line tool, and Virtual Radar Server is a Windows and Linux compatible program that is used to display the data on Google maps.

ADS-B is used as a more accurate and modern replacement for traditional aircraft radar. Instead of relying on radar reflections, ADS-B simply transmits a radio signal containing plane data such as GPS location, speed, and identification codes. Other aircraft can use this data for collision avoidance, and ground control use it for traffic management. Setting up your own RTL-SDR based ADS-B receiver allows you to see and track on a map almost all the aircraft currently flying in your area.

ADS-B Receiver With RTL SDR | Tracking Aircraft In Real-time!

NUT2NT+ Crowdfunding: Open Source GNSS RF-to-bits Receiver

Back in May 2018 we first posted about Amungo Navigation's NUT4NT+ project, which is a four channel global navigation satellite system (GNSS) board based on the NT1065 chip. With the right antenna, it is capable of receiving any navigation satellite including GPS, GLONASS, Galileo, BeiDou, IRNSS, and QZSS. With access to multiple satellite systems, the positioning resolution can be down to the centimeter.

Currently Crowd Funding now on CrowdSupply is the NUT2NT+, which is their low cost 2-input GNSS board. Early bird units are going for $250 (12 units left at the time of posting), with the normal price being $320. Compared to their previous legacy version it has an FPGA, TCXO, bias tee and other improvements. They write:

NUT2NT+ hardware is open source, as is the software - giving the user the ability to set a receiver’s modes and frequencies, to capture all signals continuously, and to have complete control over primary processing features.

Several startups and large companies offer proprietary GNSS positioning solutions and even mobile GNSS software-defined receivers. But a closed ecosystem reduces accessibility for an enthusiast or professional developer, and it limits what a user can do with their hardware. We are happy to bring NUT2NT+ to the world as an open source option.

We note that this is an advanced device for developers and experimenters, but the possible applications they write about such as precision positioning for autonomous vehicles and black box logging are quite interesting.

NUT2NT+ with RA125 antenna for precision positioning of autonomous vehicles.
NUT2NT+ with RA125 antenna for precision positioning of autonomous vehicles.

Their higher end four channel input version (which appears to only be for sale via contact on their website at the moment) can be used as a coherent receiver which can locate sources of GPS jamming via an augmented reality app. In our previous post we highlighted how they were able to find the location of the GPS jammer/spoofers famously active around the Russian Kremlin buildings.

XNZR is searching for Moscow GPS Spoofing Anomaly

SignalsEverywhere: Setting Up Priority and Groups in DSDPlus Fastlane

In his last video, Corrosive from the SignalsEverywhere YouTube channel showed us a quick guide on setting up a Phase 1 P25 digital voice decoder with two RTL-SDR dongles and the DSDPlus Fastlane decoder.

Now in his latest video Corrosive continues with the DSDPlus tutorial and this time explains how to set up priority and groups. On a trunked radio system there may be many different agencies using the same system simultaneously. Without priorities and groups, you would be listening to all communications in the system, and following a conversation within a particular agency would be difficult. Setting up priorities and groups allows you to filter out the conversations that you are not interested in, allowing you to focus on listening in to a particular agency only.

RTL SDR Digital Radio Scanning Priority and Groups With DSDPlus Fastlane Setup Tutorial

Replicating A Rolljam Wireless Vehicle Entry Attack with a Yardstick One and RTL-SDR

Over on his hackaday.io blog, Gonçalo Nespral has written about his experiences in recreating Samy Kamkars now famous low cost rolljam attack. A rolljam attack allows an attacker break into a car by defeating the rolling code security offered by wireless keyfobs. Back at Defcon 2015, an information security conference, Samy Kamkar presented a method for creating a $32 Rolljam device that consisted of two 433 MHz transceiver modules controlled by an Arduino.

In his version, Gonçalo was able to recreate the attack using a Yardstick One and an RTL-SDR. The RTL-SDR receives the signal, whilst the Yardstick One performs the jamming and retransmit functions.

Actually using this attack in a real scenario would be difficult due to the need to properly jam and receive the keyfob signal, which could prove tricky in an uncontrolled environment. However, there have been reports of criminals entering high end cars with wireless devices before and this could be one such attack method in use.

The important thing to learn is to be suspicious if your car key fob doesn't work on the first press while you are definitely in range of the car. To mitigate the possibility of wireless keyfob attacks, always use a manual key and if you must use the wireless keyfob, only unlock the car when standing right next to it, so that the keyfob signal is strong enough to overcome the jammer. Although it is still plausible that an attacker could attach the rolljam device to the car itself for greater jamming power, and then retrieve it later.

[First seen on Hackaday]

How RollJam Works
How RollJam Works

SignalsEverywhere: Using DSDPlus Fastlane for Listening to Phase 1 P25 Trunking

DSDPlus is a popular piece of software often used with RTL-SDR dongles to listen to unencrypted digital voice signals such as P25 and DMR. Digital voice is now commonly used by many Police and emergency services as well as business radio. DSDPlus fastlane is DSD's paid upgrade which allows subscribers to access to the latest releases of DSDPlus early.

Over on the SignalsEverywhere YouTube channel, Corrosive has uploaded a quick video guide that shows how to use DSDPlus Fastlane and two RTL-SDR dongles to set up a Phase 1 P25 voice decoder that automatically follows a P25 trunking channel. The basic process involves running two FMP instances which is a program in the DSDPlus suite that connects to the RTL-SDR's and receives the signal. One DSDPlus instance monitors the trunking channel, and this tunes the second FMP+DSD instance to the frequency currently active in the trunking system.

Corrosive also explains how people who are subscribed to RadioReference can download pre-populated data files that will allow the DSDPlus event log to display talkgroup information so that you can see who is talking to who.

RTL SDR Digital Radio Scanning With DSDPlus Setup FastlaneTutorial